Cannot ping through proxy

[clarkritchie]

When I ping or fping from the command line on my proxy server, my hosts are up. But when I ping from the Zabbix UI, I get 100% packet loss. Server is 2.0.8, proxy is 2.0.4.

On my proxy:


root@monitor:~# chsh -s /bin/bash zabbix
root@monitor:~# su zabbix
zabbix@monitor:/home/inveneo$ fping 10.0.0.2
10.0.0.2 is alive


On my proxy, the path to fping in zabbix_proxy.conf seems OK:

root@monitor:~# which fping
/usr/bin/fping

root@monitor:~# cat /etc/zabbix/zabbix_proxy.conf | grep fping
# Location of fping.
# Make sure that fping binary has root ownership and SUID flag set.
# FpingLocation=/usr/sbin/fping
FpingLocation=/usr/bin/fping


On my proxy, permissions and setuid are:

root@monitor:~# chown root:zabbix /usr/bin/fping
root@monitor:~# chmod 4710 /usr/bin/fping
root@monitor:~# ls /usr/bin/fping
-rws--x--- 1 root zabbix 26K Feb 2 2010 /usr/bin/fping

On my proxy, SELinux is disabled:

root@monitor:~# cat /selinux/enforce
0

On my proxy, with the LogLevel set to 4, this is the only thing I can find that seems relevant:

root@monitor:/etc/zabbix# cat /var/log/zabbix-proxy/zabbix_proxy.log | egrep -i icmp
13655:20130910:193822.635 icmp pinger #1 spent 0.000498 seconds while processing 0 items
13655:20130910:193827.637 icmp pinger #1 spent 0.000446 seconds while processing 0 items


On my proxy, there is no firewall:


root@monitor:~# ufw status verbose
Status: inactive
root@monitor:~# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

What am I missing?

[BDiE8VNy]

Does the server have direct access to the agent?

"Remote commands are not supported on Zabbix proxies, so for commands from Zabbix server to agent a direct connection is required."
See: Remote commands

ZBXNEXT-936 might be of interest to you as well.

Edit:
Assuming you're talking about this

[clarkritchie]

Hmm, no -- there is no agent involved here.

This is:

[Zabbix Server, hosted in cloud]--[Zabbix proxy, is accessible from Internet (it does collect other SNMP data)]--[Agent-less host on private network (router, switch, etc.)]

From the Zabbix web UI, the ping command doesn't work.

I don't think that is considered a remote command; it's "simple check", which is supported by the proxy according to this).

[clarkritchie]

I guess the ICMP ping response time on the Template App Agentless template seems to work, which is more important than being able to ping from the Zabbix web UI. I'll take that...

[BDiE8VNy]

Sorry, replace 'Agent' by 'Target'
On pre-condition we're talking about the possibility to klick on a hostname in frontend to execute a script, then this script is either executed in server context / or agent context.
In any case, the server has to be able to connect directly.

[clarkritchie]

In that case, it'll never work. That's fine, thanks for the clarification. I figured Zabbix Server would ask proxy to use its fping to reach the host and report back. In our case, the host is behind a firewall and Zabbix sever cannot reach it. That clears things up, thanks!